A junior developer pushes a commit to the company's public GitHub repository that includes 'OPENAI_API_KEY = "sk-proj-abc123..."' hardcoded in a Python configuration file. The repository has 3,000 stars and is actively monitored by automated secret scanning tools. The developer pushes the commit on Friday evening before going on vacation.
An LLM application's API key is hardcoded in the application's source code pushed to a public GitHub repository. What is the MOST immediate risk?
- A.A. The API key may expire and cause the application to stop working
- B.C. GitHub's terms of service prohibit hardcoded credentials and will flag the repository
- C.B. Attackers who find the repository can use the key to make unauthorized LLM API calls, generating costs, exfiltrating responses, or consuming the organization's quota
- D.D. The key may be overwritten when other developers pull the repository
Why C is correct
Hardcoded API keys in public repositories are discovered within minutes by automated scanners (GitHub secret scanning, GitLeaks, TruffleHog). Attackers can use the key immediately to: make API calls at the victim's expense, exfiltrate data sent to the API, exhaust rate limits, or pivot to other services. This is one of the most common real-world API key exposures. Options A, C, and D are secondary or incorrect.
Know someone studying for AI Security Fundamentals? Send them this one.